Sanitize waypoint fields before sending to API#69549
Conversation
This enforces a strict schema for waypoint objects to prevent data pollution. Only name, address, lat, and lng fields are now included when sending waypoints to the API. All other fields (like keyForList, pendingAction, city, state, etc.) are stripped out. Fixes Expensify/Expensify#502939 Co-authored-by: Cursor <cursoragent@cursor.com>
neil-marcellini
force-pushed
the
neil-fix-distance
branch
from
cd888eb to
87e07f1
Compare
neil-marcellini
changed the title
melvin-bot
bot
requested review from
linhvovan29546
and removed request for
a team
|
@linhvovan29546 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
melvin-bot
bot
requested review from
JmillsExpensify
and removed request for
a team
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 87e07f1d4a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The AI reviewer correctly identified that sanitizing waypoints in transactionChanges would strip keyForList from Onyx optimistic data, which is needed for UI list rendering and GPS waypoint detection. This change: - Removes sanitization from transactionChanges (preserves keyForList in Onyx) - Adds sanitization only when building API params (JSON.stringify step) This ensures Onyx has complete waypoint data while API requests only contain the allowed fields (name, address, lat, lng). Co-authored-by: Cursor <cursoragent@cursor.com>
Codecov Report❌ Looks like you've decreased code coverage for some files. Please write tests to increase, or at least maintain, the existing level of code coverage. See our documentation here for how to interpret this table.
|
Add @typescript-eslint/no-unsafe-argument to disable comments since we intentionally pass objects with extra fields to test sanitization. Co-authored-by: Cursor <cursoragent@cursor.com>
|
@codex please review |
|
Codex Review: Didn't find any major issues. Keep them coming! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
JmillsExpensify
left a comment
JmillsExpensify
left a comment
There was a problem hiding this comment.
No product review required on this one.
Resolve import conflicts in IOU/index.ts: - clearAllRelatedReportActionErrors moved to ClearReportActionErrors (from main) - Keep both sanitizeWaypointsForAPI (PR) and sanitizeRecentWaypoints (main) - Include removeDraftTransactionsByIDs (from main) Made-with: Cursor
sanitizeRecentWaypoints no longer exists in Transaction.ts - it was replaced by sanitizeWaypointsForAPI in this PR. Update the call site from main's bulk convert flow to use the correct function. Made-with: Cursor
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0644dc1e6f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Add null guard in sanitizeWaypointsForAPI to handle null waypoint entries that can occur during rollback of failed distance edits - Extract stringifyWaypointsForAPI helper to deduplicate sanitize+stringify pattern in getUpdateMoneyRequestParams and getUpdateTrackExpenseParams - Add justification comments to ESLint disable directives in tests - Add test for null waypoint entry handling Made-with: Cursor
| * Preserves keyForList and other Onyx-only fields by sanitizing at the serialization boundary | ||
| * rather than when building transactionChanges. | ||
| */ | ||
| function stringifyWaypointsForAPI(waypoints: WaypointCollection): string { |
There was a problem hiding this comment.
We are introduces stringifyWaypointsForAPI specifically to encapsulate JSON.stringify(sanitizeWaypointsForAPI(...)), and uses it in 2 places (getUpdateMoneyRequestParams and getUpdateTrackExpenseParams). However, 3 other call sites still use the manual JSON.stringify(sanitizeWaypointsForAPI(...)) pattern:
[IOU/index.ts:6416] — convertBulkTrackedExpensesToIOU
[IOU/index.ts:6700]— requestMoney
[IOU/index.ts:7499] — trackExpense
These should use stringifyWaypointsForAPI(...) for consistency.
There was a problem hiding this comment.
@MelvinBot please address this and update the code.
There was a problem hiding this comment.
I looked into this and confirmed there are 4 call sites still using the manual JSON.stringify(sanitizeWaypointsForAPI(...)) pattern instead of stringifyWaypointsForAPI(...):
src/libs/actions/Transaction.ts:399—getRoutesrc/libs/actions/IOU/index.ts:6416—convertBulkTrackedExpensesToIOUsrc/libs/actions/IOU/index.ts:6700—requestMoneysrc/libs/actions/IOU/index.ts:7499—trackExpense
The fix for each:
Transaction.ts:399 — direct replacement:
- waypoints: JSON.stringify(sanitizeWaypointsForAPI(waypoints)),
+ waypoints: stringifyWaypointsForAPI(waypoints),IOU/index.ts:6416, 6700, 7499 — keep the null guard, replace the stringify call:
-const sanitizedWaypointsForBulk = transactionWaypoints ? JSON.stringify(sanitizeWaypointsForAPI(transactionWaypoints)) : undefined;
+const sanitizedWaypointsForBulk = transactionWaypoints ? stringifyWaypointsForAPI(transactionWaypoints) : undefined;(Same pattern for the other two sites.)
Also, once the sanitizeWaypointsForAPI import is no longer directly used in IOU/index.ts, it should be removed from the import statement at line 243.
⚠️ I can't push changes to this PR because I didn't open it and I'm not listed as an assignee. To have me make this fix, add me to the PR assignees and then retry your request.
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
There was a problem hiding this comment.
@MelvinBot Okay, now you are an assignee. Please go ahead and implement this.
There was a problem hiding this comment.
Done! Pushed 588d3a1 which replaces all 4 remaining manual JSON.stringify(sanitizeWaypointsForAPI(...)) calls with stringifyWaypointsForAPI(...):
src/libs/actions/Transaction.ts:399—getRoutesrc/libs/actions/IOU/index.ts:6416—convertBulkTrackedExpensesToIOUsrc/libs/actions/IOU/index.ts:6700—requestMoneysrc/libs/actions/IOU/index.ts:7499—trackExpense
Note: sanitizeWaypointsForAPI is still imported in IOU/index.ts because it's used directly (without JSON.stringify) at line 8443.
Reviewer Checklist
Screenshots/VideosAndroid: HybridAppScreen.Recording.2026-03-11.at.16.00.58.movAndroid: mWeb ChromeScreen.Recording.2026-03-11.at.16.03.22.moviOS: HybridAppScreen.Recording.2026-03-11.at.15.52.13.moviOS: mWeb SafariScreen.Recording.2026-03-11.at.15.54.44.movMacOS: Chrome / SafariScreen.Recording.2026-03-11.at.15.26.38.movScreen.Recording.2026-03-11.at.15.45.47.mp4 |
|
@neil-marcellini Tagging you here so you don't forget about this one #69549 (comment) |
Replace manual JSON.stringify(sanitizeWaypointsForAPI(...)) calls with the stringifyWaypointsForAPI helper in getRoute, convertBulkTrackedExpensesToIOU, requestMoney, and trackExpense for consistency. Co-authored-by: Neil Marcellini <neil-marcellini@users.noreply.github.com>
|
@linhvovan29546 updated, thanks for pointing that out. |
|
@arosiclair Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
|
🎯 @linhvovan29546, thanks for reviewing and testing this PR! 🎉 An E/App issue has been created to issue payment here: #85498. |
|
🚧 @arosiclair has triggered a test Expensify/App build. You can view the workflow run here. |
|
🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
|
|
✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release. |
|
🚀 Deployed to staging by https://github.com/arosiclair in version: 9.3.40-0 🚀
|
|
🚀 Deployed to staging by https://github.com/arosiclair in version: 9.3.40-0 🚀
|
|
🚀 Deployed to production by https://github.com/cristipaval in version: 9.3.41-4 🚀
|
6 participants
Explanation of Change
Sanitize waypoints to allow only the fields we actually want to save on the backend. address, lat, lng, name. This change prevents our code from accidentally storing unwanted fields.
Fixed Issues
$ https://github.com/Expensify/Expensify/issues/502939
PROPOSAL: N/A
Tests
waypointsparameter in API requests only containsname,address,lat,lngfieldsOffline tests
N/A - Waypoint sanitization happens before API requests, so offline behavior is unchanged.
QA Steps
Same as tests
PR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectioncanBeMissingparam foruseOnyxtoggleReportand notonIconClick)src/languages/*files and using the translation methodSTYLE.md) were followedAvatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.ScrollViewcomponent to make it scrollable when more elements are added to the page.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
Changes are platform independent.
Android: Native
N/A - No UI changes, only backend API payload sanitization
Android: mWeb Chrome
N/A - No UI changes, only backend API payload sanitization
iOS: Native
N/A - No UI changes, only backend API payload sanitization
iOS: mWeb Safari
N/A - No UI changes, only backend API payload sanitization
MacOS: Chrome / Safari
2026-03-10_13-23-53.mp4
MacOS: Desktop